Combatting Alert Fatigue in Cybersecurity

If there’s one word that describes the level of activity in a modern organization’s IT network, it’s “noisy.” Hybrid work policies and heterogenous infrastructure mean traffic flows constantly between on-premises systems, remote endpoints and the cloud. Faced with an ever-expanding threat landscape of sophisticated threat actors, businesses use a slew of different security tools to fend off threats from potentially compromising weaknesses in their complex environments.

One unfortunate offshoot for security teams is that analysts have to view and understand a lot of alert data from multiple tools to protect the businesses they work for. Handling all this data can start to cause real problems to the point that it actively hampers your security defenses. Read on to get an overview of alert fatigue in cybersecurity and some actionable ways to mitigate the problem.

What is Alert Fatigue in Cybersecurity?

Alert fatigue in cybersecurity is a type of burnout that occurs when security analysts become so overwhelmed with alerts that it detracts from their ability to identify and investigate genuine cyber threats. Tons of different studies have investigated the problem of alert fatigue in cybersecurity—here are three compelling statistics that highlight the extent of the problem:

• Nine out of every 10 security teams report that they get so many false-positive alerts, which don’t indicate any security threat, to the point that there’s a negative impact on their operations
• 70% of IT security leaders say the volume of security alerts they receive on a daily basis has more than doubled in the past five years
• 78% of security analysts state that, on average, it takes 10+ minutes to investigate each security alert

Alert fatigue is related to the psychological phenomenon known as semantic satiation, which causes words and phrases to lose their meaning when subjected to extended analysis, inspection or repetition. The more security analysts get inundated with alerts, the more they start to tune them out and potentially miss genuine threats.

Tips to Combat Alert Fatigue in Cybersecurity

Alert fatigue leads to a real waste of security talent that sees teams spending their working days dealing with menial and meaningless alerts and trying their best to reduce the burden of alerts. Aside from the wasted resources, detection and response capabilities suffer badly. So, what can you do to help combat this persistent problem?

Automate Where Possible

Automation has enormous potential to significantly reduce the number of “bells and whistles” that security analysts have to pay attention to. There are various ways in which automation can play a role here, but one of them comes in the form of endpoint detection and response (EDR) runbooks, which are multistep automated responses executed on an endpoint after a triggering event or set of events. Each runbook includes an initiating condition, the steps to be performed and the end state.

Since a significant proportion of alerts that security analysts deal with likely relate to endpoint threats, getting a runbook/automation-driven EDR solution in place is a good way to introduce more automation into security teams’ workflows.

Another way to automate is to look closely at the typical analyses and queries performed during alert validation. Often, qualifying and validating alerts includes repeatable manual tasks that are the same across all types of alerts; these are ideal steps to automate. Whatever path you choose, recognize that mature and efficient security teams need to move toward automation if they’re to keep pace with the threat landscape.

Focus on Alert Quality

The alerts your security team receive should facilitate their ability to find and investigate genuine threats rather than hamper that ability. Inundating people with a volley of alerts is not an approach conducive to efficient security operations.

What analysts really need are high-fidelity alerts enriched with added context that highlights the risk level and potential business impacts. An effective security program needs to strategically mitigate risk; you can’t (and shouldn’t want to) stop every bad outcome and give equal priority to all cyber threats.

Improving alert quality starts with identifying the specific cyber risks and threat your business cares most about. Bearing these risks and threats in mind, tweak the default rules in your security tools to start providing analysts with fewer alerts. Tie automation into this process by adding context to each alert, such as the assets being targeted, before it reaches an analyst’s work queue.

Leverage Past Data

Past security data in the form of logs and records related to security investigations can prove extremely valuable in fine-tuning your detection and response efforts. This data contains a wealth of information that security teams can leverage and learn from. In particular, you want to unearth the kinds of alerts that lead to wild goose chase investigations so that you can prevent the need for expending resources on similar investigations in the future. To maintain effective security records, businesses need to keep the long-term picture in mind when responding to incidents.

Rotate Job Tasks

Another potential avenue to reduce alert fatigue is to start rotating job tasks more. When you are stretched for resources, this might not always be practical, but it’s worth taking a look at daily work tasks in an effort to try to mix things up. For example, rotate schedules so that analysts aren’t devoting too many consecutive working days to handling alerts. Exposure to other tasks, such as writing reports, threat hunting or reviewing threat intelligence can really reduce the monotony and fatigue that come from only looking at alerts.

Outsource Security Monitoring

Combatting alert fatigue in cybersecurity calls for a combination of refinements to technical, strategic and administrative processes. But there’s arguably a more effective way, which is to outsource security monitoring.

Managed detection and response (MDR) services provide ready-made expertise in alert monitoring and investigation. A good MDR provider has the know-how and infrastructure to avoid alert fatigue among its security analysts so that you’re not simply passing the buck of alert fatigue from in-house security staff to another company.

Contact Nuspire today to find out more about our outsourced 24/7 security monitoring services.